Use-after-free vulnerability in net/nfc package
Summary
GSD-2021-1000462: net/nfc: fix use-after-free llcp_sock_bind/connect. Affects Kernel versions >= adbb1d218c5f56dbae052765da83c0f57fce2a31, < 48fba458fe54cc2a980a05c13e6c19b8b2cfb610. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The net/nfc package is a part of the Linux Kernel and is responsible for handling Near Field Communication (NFC) functionality. NFC allows devices to communicate and transfer data wirelessly over short distances. The net/nfc package provides the necessary protocols and drivers for NFC communication. However, a use-after-free vulnerability has been discovered in the llcp_sock_bind/connect functions of the net/nfc package.
Vulnerability Detail
The use-after-free vulnerability in the llcp_sock_bind/connect functions of the net/nfc package allows an attacker to exploit a freed memory region. This can lead to various consequences, including remote code execution, privilege escalation, or denial of service. The vulnerability was introduced in Linux Kernel version v4.19.187 and is fixed in version v4.19.191. The vulnerability occurs when the llcp_sock_bind/connect functions are called after the corresponding socket has been closed, resulting in a use-after-free scenario.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid the use of the llcp_sock_bind/connect functions in the net/nfc package. This can be achieved by disabling NFC functionality or modifying the affected code to use alternative methods for socket binding and connection establishment.
Conclusion
The use-after-free vulnerability in the net/nfc package can have severe security implications. It is crucial to update the Linux Kernel to the latest version and regularly apply security patches to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
The net/nfc package is a component of the Linux Kernel that handles Near Field Communication (NFC) functionality.
A use-after-free vulnerability occurs when a program continues to use a memory region after it has been freed. This can lead to various security issues, including remote code execution and denial of service.
The use-after-free vulnerability in the net/nfc package can potentially allow an attacker to execute arbitrary code, escalate privileges, or cause a denial of service.
To fix this vulnerability, it is recommended to update the Linux Kernel to version v4.19.191 or later. Regularly updating the kernel is also advisable to ensure the latest security patches are applied.
As a temporary workaround, users can disable NFC functionality or modify the affected code to use alternative methods for socket binding and connection establishment.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
